CVE-2021-47282 is a vulnerability identified in the Linux kernel's SPI (Serial Peripheral Interface) driver for the bcm2835 controller, commonly used in Raspberry Pi devices and other embedded systems. The issue arises from improper handling of chip select (CS) lines when more than four SPI slaves are configured. Originally, a commit (571e31fa60b3) limited the number of native chip selects to three due to a statically-sized array (prepare_cs[]) that stores per-slave register values. However, this limitation only applied to native chip selects, not GPIO-based chip selects specified via the device tree. When GPIO chip selects exceed three, the num_chipselect value is silently increased by the of_spi_get_gpio_numbers() function, leading to out-of-bounds array accesses on prepare_cs[]. This can cause memory corruption within the kernel, potentially leading to system instability, crashes, or escalation of privileges if exploited. The fix involves increasing the allowed number of slaves to 24, enforcing limits during slave setup, and reverting num_chipselect to three for native chip selects. This patch is backported to stable kernel versions, with future updates planned to support arbitrary numbers of slaves safely. No known exploits are currently reported in the wild, and the vulnerability primarily affects Linux kernel versions including the specified commit hash. The vulnerability is technical and specific to embedded Linux systems using the bcm2835 SPI controller with multiple GPIO chip selects configured beyond the native limit.

For European organizations, the impact of CVE-2021-47282 depends largely on their use of embedded Linux devices, particularly those based on the bcm2835 SPI controller such as Raspberry Pi devices or similar hardware in industrial control systems, IoT deployments, or edge computing environments. Exploitation could lead to kernel memory corruption, causing device crashes or potential privilege escalation, which in turn could disrupt critical services or allow attackers to gain unauthorized control over affected devices. This is particularly concerning for sectors relying on embedded Linux for automation, manufacturing, or critical infrastructure monitoring. While no exploits are currently known, the vulnerability's nature means that if exploited, it could undermine system integrity and availability. Confidentiality impact is lower unless combined with other vulnerabilities. The risk is higher in environments where multiple SPI slaves are configured via GPIO chip selects beyond the native limit, a configuration more common in complex embedded systems. Organizations using standard desktop or server Linux distributions without bcm2835 hardware are unlikely to be affected.

European organizations should first identify any embedded Linux devices using the bcm2835 SPI controller, especially those with multiple SPI slaves configured via GPIO chip selects. They should apply the latest Linux kernel patches that address CVE-2021-47282, ensuring the kernel version includes the fix that raises the allowed slaves to 24 and enforces proper limits. For devices where kernel updates are not immediately feasible, organizations should audit device tree configurations to ensure no more than three GPIO chip selects are specified, thereby avoiding out-of-bounds access. Additionally, implement strict device management policies to control firmware and kernel updates on embedded devices. Monitoring kernel logs for unusual SPI-related errors or crashes can help detect exploitation attempts. For critical infrastructure, consider network segmentation and limiting access to embedded devices to reduce attack surface. Finally, maintain an inventory of embedded devices and their kernel versions to prioritize patching and risk assessment.